From 032e778a6dc1ee2173c4cdb2c671180c5b5df245 Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Wed, 12 Apr 2023 14:39:10 +0200
Subject: Simplify `ndpi_internal_guess_undetected_protocol()` (#1941)

`ndpi_guess_undetected_protocol()/ndpi_internal_guess_undetected_protocol()`
is a strange function:
* it is exported by the library and it is actively used by `ntopng`
* it is intrinsecally ipv4-only
* it returns basically something like "classification_by_ip"/"classification_by_port"
(these information have already been calculated in `ndpi_do_guess()`...)
* it access the bittorrent LRU caches (similarly to
`ndpi_detection_giveup()` but without all the other caches...)

So:
* make the interface IPv4/6 agnostic
* use the classifications already available

This work will allow to make the Bittorrent caches IPV6-aware (see
81e1ea5).

Handle Dropbox classification "by-port" in the "standard" way.
---
 src/lib/protocols/tcp_udp.c | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

(limited to 'src/lib/protocols/tcp_udp.c')

diff --git a/src/lib/protocols/tcp_udp.c b/src/lib/protocols/tcp_udp.c
index ec49e63ba..473260adf 100644
--- a/src/lib/protocols/tcp_udp.c
+++ b/src/lib/protocols/tcp_udp.c
@@ -25,18 +25,11 @@
 u_int ndpi_search_tcp_or_udp_raw(struct ndpi_detection_module_struct *ndpi_struct,
 				 struct ndpi_flow_struct *flow,
 				 u_int8_t protocol,
-				 u_int32_t saddr, u_int32_t daddr, /* host endianess */
-				 u_int16_t sport, u_int16_t dport) /* host endianess */
+				 u_int32_t saddr, u_int32_t daddr) /* host endianess */
 {
   u_int16_t rc;
   struct in_addr host;
 
-  if(protocol == IPPROTO_UDP) {
-    if((sport == dport) && (sport == 17500)) {
-      return(NDPI_PROTOCOL_DROPBOX);
-    }
-  }
-
   if(flow)
     return(flow->guessed_protocol_id_by_ip);
   else {
@@ -51,7 +44,6 @@ u_int ndpi_search_tcp_or_udp_raw(struct ndpi_detection_module_struct *ndpi_struc
 
 void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
-  u_int16_t sport, dport;
   u_int proto;
   struct ndpi_packet_struct *packet;
 
@@ -59,10 +51,6 @@ void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, st
     return;
 
   packet = &ndpi_struct->packet;
-
-  if(packet->udp) sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
-  else if(packet->tcp) sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest);
-  else sport = dport = 0;
   
   if(packet->iph /* IPv4 Only: we need to support packet->iphv6 at some point */) {
     proto = ndpi_search_tcp_or_udp_raw(ndpi_struct,
@@ -70,8 +58,7 @@ void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, st
 				       packet->iph ? packet->iph->protocol :
 				       packet->iphv6->ip6_hdr.ip6_un1_nxt,
 				       ntohl(packet->iph->saddr), 
-				       ntohl(packet->iph->daddr),
-				       sport, dport);
+				       ntohl(packet->iph->daddr));
 
     if(proto != NDPI_PROTOCOL_UNKNOWN)
       ndpi_set_detected_protocol(ndpi_struct, flow, proto, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_MATCH_BY_PORT);
-- 
cgit v1.2.3